#Required Apache modules:
#headers, proxy, proxy_http, proxy_wstunnel, ssl, rewrite

<VirtualHost *:80>
        ServerName vaultwarden.example.com
        ErrorLog ${APACHE_LOG_DIR}/vaultwarden-error.log
        CustomLog ${APACHE_LOG_DIR}/vaultwarden-access.log combined

        # Redirect to https    
        RewriteEngine On
        RewriteCond %{HTTPS} off
        RewriteRule (.*) https://%{SERVER_NAME}/$1 [R,L]
</VirtualHost>

<VirtualHost *:443>
	ServerName vaultwarden.example.com
        ErrorLog ${APACHE_LOG_DIR}/vaultwarden-error.log
        CustomLog ${APACHE_LOG_DIR}/vaultwarden-access.log combined

        # Reverse Proxy
	RewriteEngine On
	RewriteCond %{HTTP:Upgrade} =websocket [NC]
	RewriteRule /notifications/hub(.*) ws://127.0.0.1:3012/$1 [P,L]
	ProxyPass / http://127.0.0.1:8000/

	ProxyPreserveHost On
	ProxyRequests Off
	RequestHeader set X-Real-IP %{REMOTE_ADDR}s

        # TLS
	# Please generate a secure TLS configuration with the Mozilla SSL Configuration Generator: https://ssl-config.mozilla.org/
	SSLEngine on
        SSLCertificateFile /etc/ssl/certs/vaultwarden-fullchain.crt
        SSLCertificateKeyFile /etc/ssl/private/vaultwarden.key

        # HSTS
	Header always set Strict-Transport-Security "max-age=63072000"
</VirtualHost>